nano-banana
Pass
Audited by Gen Agent Trust Hub on May 5, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes official Google SDKs (
@google/genaiandgoogle-genai) and connects to well-known Google API endpoints (generativelanguage.googleapis.com) to perform its intended image generation tasks. These sources are established and trusted. - [CREDENTIALS_UNSAFE]: The documentation follows secure development practices by instructing users to store sensitive API keys in environment variables (.env files) rather than hardcoding them in scripts.
- [COMMAND_EXECUTION]: Provides transparent shell and Python code snippets for users to verify their connection and process image data. These scripts perform standard operations such as JSON parsing and Base64 decoding of image data from the official API response.
- [PROMPT_INJECTION]: The skill's primary function involves interpolating user input into prompts for an image generation model. This creates an indirect prompt injection surface; however, the skill includes structural prefixes (e.g., 'Generate an image:') to guide model behavior, and the risk is consistent with the primary purpose of the tool.
Audit Metadata